C:\Users\ospaka\source\repos\guid\Release\guid.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d89b3de883726515580eddbbd9d1dad155717cdb40efbc90c8a03603e3574be5
-
Size
200KB
-
MD5
4beb9eb50689d1cfaf107b417ac719fc
-
SHA1
dd8155486ce59cfb8c7d045879c2cc5a668e4c42
-
SHA256
d89b3de883726515580eddbbd9d1dad155717cdb40efbc90c8a03603e3574be5
-
SHA512
1bbcfd1a45123fb1d618d0411f3e733cc967fcda422a50442a0c4b8aa731735cb18f70fb2966baf82802478621f19612c42da3356218be64ba3ad500a16fbb95
-
SSDEEP
6144:hjFgNCGC5hxfuU3e/EjQ48ZD1rEggSnxf:hhgNCjlnO/EUtR2Hgxf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe
Files
-
JaffaCakes118_d89b3de883726515580eddbbd9d1dad155717cdb40efbc90c8a03603e3574be5.zip
Password: infected
-
2e417482a83d63f83f19dff658e7eec05ffb89c4d7b9e417eb8ec2951c4973fd.exe.exe windows:6 windows x86 arch:x86
43c06cb0e9362c127c04b1f36a2c528b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
CreateMutexA
Sleep
GetLastError
LoadLibraryA
GetProcAddress
GetTickCount
WriteConsoleW
WideCharToMultiByte
GetCurrentThreadId
CloseHandle
WaitForSingleObjectEx
SwitchToThread
RaiseException
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
ExitThread
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
Sections
.text Size: 270KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ